This vulnerability in Edge-Themes Eldon (<=1.4.1) is caused by unsafe deserialization of untrusted data, leading to unauthenticated PHP object injection. The flaw allows remote attackers to execute arbitrary code, resulting in full compromise of the affected system. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, and no privileges or user interaction required. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation can lead to remote code execution without authentication, compromising the confidentiality, integrity, and availability of the affected system. This can result in full system compromise, data theft, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected application and monitor for suspicious activity related to deserialization. Avoid exposing the vulnerable service to untrusted networks.